CVE-2015-4041

The keycompare_mb function in sort.c in sort in GNU Coreutils through 8.23 on 64-bit platforms performs a size calculation without considering the number of bytes occupied by multibyte characters, which allows attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via long UTF-8 strings.

• CWE-787

• http://openwall.com/lists/oss-security/2015/05/15/1Exploit, Mailing List, Patch, Third Party Advisory
• https://bugzilla.suse.com/show_bug.cgi?id=928749Issue Tracking, Third Party Advisory
• https://github.com/pixelb/coreutils/commit/bea5e36cc876ed627bb5e0eca36fdfaa6465e940Patch
• http://openwall.com/lists/oss-security/2015/05/15/1Exploit, Mailing List, Patch, Third Party Advisory
• https://bugzilla.suse.com/show_bug.cgi?id=928749Issue Tracking, Third Party Advisory
• https://github.com/pixelb/coreutils/commit/bea5e36cc876ed627bb5e0eca36fdfaa6465e940Patch

Published

Jan 24, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2015-4035scripts/xzgrep.in in xzgrep 5.2.x before 5.2.0, before 5.0.0…
• CVE-2015-4036Array index error in the tcm_vhost_make_tpg function in driv…
• CVE-2015-4037The slirp_smb function in net/slirp.c in QEMU 2.3.0 and earl…
• CVE-2015-4038The WP Membership plugin 1.2.3 for WordPress allows remote a…
• CVE-2015-4039Multiple cross-site scripting (XSS) vulnerabilities in the W…5.4
• CVE-2015-4040Directory traversal vulnerability in the configuration utili…
• CVE-2015-4042Integer overflow in the keycompare_mb function in sort.c in …9.8
• CVE-2015-4043SQL injection vulnerability in ConnX ESP HR Management 4.4.0…
• CVE-2015-4045The sudoers file in the asset discovery scanner in AlienVaul…
• CVE-2015-4046The asset discovery scanner in AlienVault OSSIM before 5.0.1…
• CVE-2015-4047racoon/gssapi.c in IPsec-Tools 0.8.2 allows remote attackers…
• CVE-2015-4049Unisys Libra 43xx, 63xx, and 83xx, and FS600 class systems w…